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The authors of Ref. 0] claim that the an protocol Q 
is entirely equivalent to a classical stream cipher utiliz- 
ing no quantum phenomena, a common misconception. 
Indeed, a paper has already appeared in Phys. Lett. A 
to a similar effect, and we have responded p|. Still, 
we welcome the opportunity to clarify the situation for a 
wider audience. 

Before proceeding, we need to point out a terminologi- 
cal shortcoming in Ref. 0] that further confuses the issue. 
The term one-time pad is consistently used in Ref. 0] to 
mean a conventional (classical) cipher with a shared se- 
cret key, and should always be interpreted as such in 
reading Ref Furthermore, one cannot state that such 
a classical cipher with a shared secret key is "not secure" , 
as security needs to be quantified. The main points of 
Ref. are that a) the security of an is "unrelated to 
quantum noise" for direct encryption, and b) an cannot 
be used to "expand the secret information they share" 
for key generation. 

Our response, in sum, is that there is a distinction be- 
tween what has been achieved in our experiments and 
what is in principle possible with the an protocol. It is 
true that our experiments, thus far, have not operated 
in a regime which allows key generation and we have not 
claimed that they have; but in principle key generation 
is possible as already indicated in Ref. Q , a crucial point 
missed in For direct encryption our experiments do 
utilize quantum noise in an essential way that could be 
done classically in principle, though not in practice. In 
principle, an may perform far beyond a conventional ci- 
pher, especially with added techniques and lower signal 
energy. These are described in some detail in Ref. p| and 
briefly discussed in Ref. 0. 

The mistake in claiming that ar\ cannot generate new 
key derives from ignoring the optimal quantum receiver 
performance between Eve who does not know the key 
K when she makes her quantum measurement, and Bob 
who does. It follows from quantum detection theory [|| 
that the bit-error rates in discriminating an antipodal sig- 
nal set with the optimum quantum-receiver, an optimum 
quantum phase-measurement, and balanced heterodyne- 
detection are 

P e opt ~e- 45 , P e ph ~e- 2S , P e hct ~e- S , (1) 


respectively, where S is the signal photon number. Note 
that while the transmitted signal set is M-ry, use of the 
secret key collapses the signal set to binary antipodal 
|2( . Further note that the optimum quantum- receiver 
performance can only be achieved if the secret key is used 
during measurement; something only Bob can do. This is 
a quantum effect with no classical analog, and represents 
a key generation principle fundamentally different from 
the well known BB84 and Ekert protocols. 

For bounding Eve's performance, we may grant her a 
full copy of the quantum signal and allow her to per- 
form any quantum measurement. We have shown nu- 
merically that Eve's optimum quantum receiver's perfor- 
mance approaches that of the optimal quantum phase- 
measurement - still a factor of two in the exponent worse 
than Bob's optimum receiver. As an example with a 
mesoscopic signal level S ~ 7, one has P° pt ~ 1CP 12 , 
P e ph ~ 10" 6 , and P e hGt - ICT 3 . At a 1 Gbps data rate, 
Alice/Bob are likely to generate ~ 10 3 or ~ 10 6 new key 
bits per second (with privacy amplification) depending 
on Eve's exact measurement. Note that while Eqn. Q] 
also applies for large S, the resulting key generation rate 
would be extremely low. 

For direct encryption, the coherent-state quantum 
noise is used in the experiments of Ref. Q to provide 
high speed randomization that can in principle, but not 
now in practice, be done classically. This randomization 
is what distinguishes an from a conventional cipher. 
Moreover, with the additional mechanisms like deliber- 
ate state-randomization, as described briefly in Ref. p|, 
information-theoretic security against known-plaintext 
attacks may be obtained - something that has yet to be 
shown for any conventional cipher. Addressing another 
criticism in Ref. [l|, using many bits of the running key 
does not reduce the efficiency of the seed key K. The 
efficiency and security of conventional and quantum 
cryptographic systems are much more subtle issues than 
the treatment available in the literature may suggest. 
Some detailed discussions of these issues, particularly 
those related to an, are given in Ref. 0- 
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